Получите привилегии администратора с gsudo

The Windows Insider Preview build 26052 just shipped with a sudo command, I thought I’d just take a quick peek to see what it does and how it does it. This is only a short write up of my findings, I think this code is probably still in early stages so I wouldn’t want it to be treated too harshly. You can see the official announcement

To run a command using sudo you can just type:

C:\> sudo powershell.exe

This is slightly disappointing as I was hoping the developers would have implemented a sudo service running at a higher privilege level to mediate access. Instead this is really just a fancy executable that you can elevate using the existing UAC mechanisms. 

There are four modes of operation that can be configured in system settings, why this needs to be a system setting I don’t really know. 

Initially sudo is disabled, running the sudo command just prints “Sudo is disabled on this machine. To enable it, go to the Developer Settings page in the Settings app”. This isn’t because of some fundamental limit on the behavior of the sudo implementation, instead it’s just an which is set to 0.

The next option (value 1) is to run the command in a new window. All this does is pass the command line you gave to sudo to verb. Therefore you just get the normal UAC dialog showing for that command. Considering the general move to using PowerShell for everything you can already do this easily enough with the command:

PS> Start-Process -Verb runas powershell.exe

C:\> sudo elevate -p 1234 powershell.exe

Oddly, as we’ll see passing the PID and the command seems to be mostly unnecessary. At best it’s useful if you want to show more information about the command in the UAC dialog, but again as we’ll see this isn’t that useful.

The only difference between the two is “With input disabled” you can only output text from the elevated application, you can’t interact with it. Whereas the Inline mode allows you to run the command elevated in the same console session. This final mode has the obvious risk that the command is running elevated but attached to a low privileged window. Malicious code could inject keystrokes into that console window to control the privileged process. This was pointed out in the Microsoft blog post linked earlier. However, the blog does say that running it with input disabled mitigates this issue somewhat, as we’ll see it does not.

How It Really Works

What always gets me interested is where there’s an RPC channel involved. The reason a communications channel exists is due to the limitations of UAC, it very intentionally doesn’t allow you to attach elevated console processes to an existing low privileged console (UAC is not a security boundary, but then why did this do this if it wasn’t ). It also doesn’t pass along a few important settings such as the current directory or the environment which would be useful features to have in a sudo like command. Therefore to do all that it makes sense for the normal privileged sudo to pass that information to the elevated version.

Let’s check out the RPC server using NtObjectManager:

PS> $rpc = Get-RpcServer C:\windows\system32\sudo.exe

PS> Format-RpcServer $rpc

HANDLE p0 – Handle to the calling process.

int p1 – The type of the new process, 2 being input disabled, 3 being inline.

char* p2 – The command line to execute (oddly, in ANSI characters)

int p4 – Size of p3.

char* p5 – The current directory.

int p6 – Not sure, seems to be set to 1 when called.

int p7 – Not sure, seems to be set to 0 when called.

The RPC server is registered to use with the port name being where PID is just the value passed on the elevation command line for the argument. The PID isn’t used for determining the console to attach to, this is instead passed through the HANDLE parameter, and is only used to query its PID to pass to the

PS> $c = Get-RpcClient $rpc

PS> Connect-RpcClient $c -EndpointPath sudo_elevate_4652

There are no checks for the caller’s PID to make sure it’s really the non-elevated sudo making the request. As long as the RPC server is running you can make the call. Finding the ALPC port is easy enough, you can just enumerate all the ALPC ports in l to find them. 

PS> Start-Process -Verb runas -FilePath sudo -ArgumentList “elevate”, “-p”, 1111, “cmd.exe”

Fortunately sudo will exit immediately if it’s configured in disabled mode, so as long as you don’t change the defaults it’s fine I guess.

Looking back at how the RPC server is registered can be enlightening:

  result = RpcServerUseProtseqEpA(“ncalrpc”, 

      RPC_C_PROTSEQ_MAX_REQS_DEFAULT, Endpoint, NULL);

  if ( !result )

    result = RpcServerRegisterIf(server_sudo_rpc_ServerIfHandle, NULL, NULL);

    if ( !result )

      return RpcServerListen(1, RPC_C_PROTSEQ_MAX_REQS_DEFAULT, 0);

PS> $as = Get-NtAlpcServer

PS> Format-NtSecurityDescriptor $sudo -Summary

<Group> : DESKTOP-9CF6144\None

Yup, the DACL for the ALPC port has the group. It would even allow restricted tokens with the SID set such as the Chromium GPU processes to access the server. This is pretty poor security engineering and you wonder how this got approved to ship in such a prominent form. 

I will give Microsoft props though for writing the code in Rust, at least most of it. Of course it turns out that the likelihood that it would have had any useful memory corruption flaws to be low even if they’d written it in ANSI C. This is a good lesson on why just writing in Rust isn’t going to save you if you end up just introducing logical bugs instead.

Microsoft официально представила новую функцию «Sudo для Windows» для Windows 11. Компания опубликовала наработки по проекту утилиты sudo на GitHub под открытой лицензией MIT. «Sudo для Windows» появилась спустя 44 года после выхода первой версии sudo на 4.1BSD.

«Наша команда работает над открытием исходного кода “Sudo для Windows”. Вы можете внести свой вклад в скрипт sudo.ps1. Он предназначен для создания вспомогательной оболочки sudo.exe, которая обеспечивает более удобный интерфейс использования sudo из PowerShell», — обратились к сообществу специалисты из Microsoft.

Примечательно, что репозиторий Sudo for Windows Documentation ещё закрыт, но находится в разработке.

Sudo можно будет включить через настройки для разработчика. Эта опция позволит управлять настройками, требующими административных привилегий, например, удалением приложений или изменением системных настроек.

Также можно будет включить Sudo для Windows, выполнив следующую команду в сеансе консоли с повышенными привилегиями: sudo config –enable <configuration_option>.

При активации опции можно будет настроить поведение команд sudo, установив предпочтения для работы команд, запускаемых с помощью этой утилиты. Для этого нужно выбрать один один из трёх режимов работы sudo: In a New Window (forceNewWindow), Input closed (disableInput) и Inline (normal):

Пример работы с Sudo в режиме New Window (запуск команды sudo netstat -ab):

В Microsoft пояснили, что проект только начал развиваться. «Если вам нужны дополнительные опции, которых нет в “Sudo для Windows”, ознакомьтесь с gsudo разработчика Джерардо Гриньоли. Этот проект имеет ряд дополнительных функций и параметров конфигурации», — уточнили разработчики из Microsoft.

A Brief History of Sudo. Sudo было задумано и реализовано Бобом Коггешхоллом и Клиффом Спенсером примерно в 1980 году на факультете компьютерных наук SUNY/Buffalo, первый запуск утилиты был на VAX-11/750 под управлением 4.1BSD. Sudo в его нынешнем виде поддерживается мейнтейнером проекта Тоддом К. Миллером , который продолжает улучшать sudo и исправлять ошибки.

Если эта публикация вас вдохновила и вы хотите поддержать автора — не стесняйтесь нажать на кнопку

Похожее:

Полезные заготовки вызова утилит командной строки Как развернуть сценарий power shell в active directory с использованием gpo Windows 10 1080P, 2K, 4K, 5K HD wallpapers free download | Wallpaper Flare «Изменение размера шрифта для устройств Nokia по сравнению с изменением общего масштаба шрифта приложения на Android с использованием Configuration.fontScale»?